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It  will  detect,  analyze  and  provide  emergency  checklists  for  any  faults  that 
it  is  programmed  to  monitor  for  in  these  subsystems.  This  report  represents 
a  tieing  together  of  Tasks  I  &  II  to  provide  a  baseline  for  defining  the 
requirements  of  the  feasibility  demonstration  hardware.  In  Task  I,  helicopters 
representing  all  operational  helicopter  categories  (car^go,  utility,  scout,  and 
attack)  were  identified  and  a  signal  analysis  was  done  on  each.  While  the 
EMMADS  functions  described  in  this  report  are  applicable  to  all  helicopter 
categories  studied  under  Tasks  I  &  II,  specific  examples  used  herein  are  all 
related  to  the  CH-47C  helicopter*  since  this  aircraft  had  been  selected  as 
the  basis  for  the  EMMADS  feasibiltty  model. 
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1.0  SCOPE 


This  report  describes  the  results  of  work  done  under  Task  I  of 
contract  No.  DAAK  80-79-C-0270 ,  to  establish  basic  system 
operating  requirements  for  an  Electronic  Master  Monitor  and 
Advisory  Display  System  (EMMADS).  This  system  is  being  developed 
for  use  on  U.S.  Army  helicopters  to  reduce  crew  workload  by 
assuming  responsibility  for  tasks  associated  with  subsystem 
status  monitoring.  EMMADS  will  integrate  all  instrumentation 
normally  dedicated  to  subsystem  status  monitoring  (e.g.  all 
pressures,  temperatures,  etc.)  plus  caution/warning/advisory 
indicators,  into  a  computer  controlled,  solid  state  system.  It 
will  detect,  analyze  and  provide  emergency  checklists  for  any 
faults  that  it  is  programmed  to  monitor  for  in  these  subsystems. 

While  this  report  is  being  identified  with  Task  I  elements  of  the 
contract,  it  in  fact  also  represents  a  tieing  together  of  Tasks  I 
&  II  to  provide  a  baseline  for  defining  the  requirements  of  the 
feasibility  demonstration  hardware  of  Task  IV.  In  Task  I, 
helicopters  representing  all  operational  helicopter  categories 
(cargo,  utility,  scout  and  attack)  were  identified  and  a  signal 
analysis  was  done  on  each.  The  results  of  the  analyses  for  these 
aircraft  (CH-47C,  UH-60A,  0H-58C  and  YAH-64  respectively)  are  in 
the  form  of  Subsystem  Parameter  Data  Lists,  shown  in  Appendix  1. 
Under  Task  II,  surveys  of  pilots  were  made  to  determine  when  and 
how  information  should  be  displayed  (see  EMMADS  Human  Engineering 
Summary  Report).  Coupling  all  of  the  above  information  together 
with  a  thorough  understanding  of  flight  operations,  the  Systems 
Engineering  task  of  developing  and  implementing  a  coherent  EMMADS 
operating  philosophy  was  accomplished.  This  resulted  in  a  system 
design  based  on  the  following  underlying  principles: 

a)  The  aircrew  should  be  managers  of  the  aircraft  and  as 
such  must  have  information  required  for  operation  of 
the  aircraft  in  minimum  time  and  in  the  simplest  pos¬ 
sible  form. 


b)  The  pilot  in  any  flight  situation  must  be  able  to  fly 
the  aircraft,  i.e.,  he  must  retain  or  regain  control  of 
the  aircraft.  Any  system  that  relates  to  this  function 
(such  as  EMMADS)  must  enhance  this  capability  and 
absolutely  cannot  interfere  with  it. 

c)  During  fault  display  operations,  interactive  manual 
inputs  to  EMMADS  by  the  aircrew  should  be  kept  to  a 
minimum. 

These  principles  then  form  the  core  of  the  EMMADS  operating 
philosophy.  In  this  report,  each  element  of  the  system's 
operation  is  presented  and  justified  in  terms  of  this  philosophy. 

While  the  EMMADS  functions  described  in  this  report  are 
applicable  to  all  helicopter  categories  studied  under  Tasks  I  & 
II,  specific  examples  used  herein  are  all  related  to  the  CH-47C 
helicopter,  since  this  aircraft  had  been  selected  as  the  basis 
for  the  EMMADS  feasibility  model. 
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2.0  APPLICABLE  DOCUMENTS 


Electronic  Master  Monitor  and  Advisory  Display  System:  Human 
Factors  Engineering  Summary  Report  (ACS  12,385),  R.  McLane, 
Reliability  and  Human  Factors  Engineering,  GE,  Pittsfield,  MA, 
Aug.  1980. 

Subsystem  Parameter  Data  Lists  for  CH-47C,  UH-60A,  OH-58C  & 
YAH-64  (ACS  11,995)  Appendix  1,  General  Electric  Co.,  Binghamton, 
NY. 


Technical  Proposal  for  the  Electronic  Master  Mon; tor  and  Advisory 
Display  System  -  Part  1  (ACS  11,773-1),  February  1979,  General 
Electric  Aircraft  Equipment  Division,  Binghamton,  NY. 

TM  55-1520-227-10-2,  Operator's  Manual,  Army  Model  CH-47C 
Helicopter,  23  August  1978. 

Advanced  Subsystem  Status  Monitor,  Final  Report,  Contract 
DAAK51 -78-C-0023,  Sikorsky  Aircraft,  Div.  of  United  Technologies 


3.0  EMMADS  CHARACTERISTICS 


3.1  System  Overview 

The  block  diagram  shown  in  Figure  1  illustrates  ihe  basic  EMMADS 
architecture  as  installed  on  an  aircraft.  The  system  utilizes  a 
dual  1553B  digital  bus  for  data  transmission.  RTU's  provide  the 
interface  required  to  digitally  encode  and  place  on  the  bus  the 
aircraft  sensor  signals  described  in  Appendix  1.  Two  digital 
display  processors  perform  the  monitoring  and  fault  detection 
functions  described  in  this  report.  They  also  determine  the 
current  formats  to  be  displayed  on  the  electroluminesrent  fiat 
panels.  Note  that  a  separate  processor  is  to  be  made  usable  at 
each  crew  station.  A  set  of  multilegend  display  switches  (MLDS) 
associated  with  each  display  unit,  provide  the  pilot  with  displaj 
control  during  all  system  operations.  A  keyboard  is  provided  for 
data  inputs  to  the  system  also.  Provision  for  expanding  system 
capabilities  to  include  audio  warning  is  also  shown. 

3.2  System  Functions 

The  EMMADS  operational  functions  requirements  are  described  in 
this  report  according  to  the  system's  primary  and  secondary 
functions. 

The  primary  functions  of  an  EMMADS  are: 

a)  Provide  a  continuous  display  of  Rotor  RPM,  Torque, 
Flight  Time  Remaining  (based  on  continuously  monitored 
fuel  consumption)  and,  when  applicable,  a  countdown  of 
remaining  allowable  time  for  operation  of  parameters 
within  time  limited  ranges.  It  shall  also  display 
non-flight  parameters  to  aircrew  members  upon  request. 

b)  Monitor  aircraft  subsystem  parameters  for  possible 
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faults.  This  monitoring  activity  includes: 


1)  Correlation  of  current  parameter  status  (value) 
with  a  particular  limit  or  set  of  limits,  the 
values  of  which  may  be  functionally  dependent  on 
other  parameter  values.  A  parameter  value  that 
approaches,  meets  or  exceeds  an  associated  limit 
requires  that  the  aircrew  be  notified. 

2)  Cor  elation  of  the  time  rate  of  change  of  a 

par  neter  value  with  a  maximum  allowable  rate  of 
chir.ge  based  on  manuf acturer/procurement 
sp«  ifications  or  some  experimentally  established 
bas  line.  A  rate  of  change  that  exceeds  this 
max  mum  value  requires  notification  of  the 
aii  rew. 

c)  Detect  t  < nposite  faults  resulting  from  multiple 
parametei  excursions.  Provide  an  unambiguous 
notification  of  the  fault  nature  to  the  aircrew. 

d)  Display  aults  to  the  crew  utilizing  a  flexible 
prioriti  ation  system  and  provide  a  means  of  rapidly 
communic.  "ing  to  EMMADS  the  pilot’s  observation  of  jach 
fault. 

e)  Display  recommended  fault  correction  actions  (emergency 
checklists)  in  response  to  aircrew  requests. 

The  secondary  functions  of  EMMADS  include: 

a)  The  ability  to  display  routine,  interactive  type  check¬ 
lists  such  as  the  Before  Starting  Engines,  Starting 
Engines,  Engine  Ground  Operation,  Before  Taxi,  Taxiing 
Check,  Before  Takeoff,  Cruise  Check,  Before  Landing, 

After  Landing  and  Engine  Shutdown  Checklists. 
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b)  Calculations  to  predict  aircraft  performance 
characteristics. 

c)  Recording  the  occurrence  of  any  faults,  as  required  for 
post-flight  maintenance  analysis. 


3.2.1  Primary  Functions 

3. 2. 1.1  Display  Areas 


The  EMMADS  display  is  broken  into  three  areas  to  facilitate 
efficient  information  transfer  to  the  pilot.  These  are  sho*n  in 
Figure  2.  (Note:  In  this  and  all  other  figures  showing  display 
formats,  boxes  are  drawn  around  alphanumeric  characters  and  may 
also  be  shown,  empty,  in  other  areas  of  the  display.  These  are 
not  part  of  the  format,  but  are  used  to  indicate  the  amount  of 
space  reserved  for  these  characters.)  The  Dedicated  Status  Area 
is  utilized  for  information  requiring  continuous  display.  This 
includes  rotor  rpm,  torque  and  remaining  flight  time  (in 
minutes).  Other  items  shown  in  this  area  are  connected  with 
fault  detection  aspects  of  EMMADS.  Once  activated,  they  remain 
in  this  area,  continuous  displayed,  until  deactivated  by  other 
fault  logic.  Their  operation  is  further  described  in  Section 
3.2. 1.3.  The  Warning  Message  Area  is  reserved  for  displaying  up 
to  six  messages  of  eight  characters  each,  under  conditions 
described  in  3. 2. 1.3.  The  Subsystem  Data  Area  is  utilized  for 
displaying  parameters  in  the  engine,  fuel,  transmission, 
electrical,  hydraulic  and  miscellaneous  subsystems,  as  well  as 
emergency  action  checklists.  (The  engine  subsystem  is  shown  as 
an  example  in  Figure  2. )  The  dotted  lines  shown  with  the  bar 
(thermometer  type)  scales  and  pointer  scales  indicate  these 
symbols  can  oversize  to  indicate  a  fault  with  that  parameter. 
Oversized,  hollow  indicators  are  used  to  depict  rate  (trend)  type 
faults,  while  oversized,  filled-in  symbols  indicate  a  limit  type 
fault.  Special  symbols  for  chips  (*)  and  other  discrete  type 
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Dedicated  Status  Area 


Warning  Message  Area 


Subsystem  Data  Area 


faults  are  also  used  (e.g.  QTY  indicates  low  engine  oil  quantity 
and  CTL  indicates  that  an  Nl  control  loop  is  energized).  These 
and  other  faults  are  described  in  Sections  3. 2. 1.2  and  3. 2. 1.3. 

3. 2. 1.2  Fault  Detection 

The  primary  functions  of  fault  detection  and  fault/  parameter 
display  are  to  be  performed  on  a  continuous  basis,  i.e.  they  are 
accomplished  independent  of  flight  phase.  The  primary  functions 
must  be  considered  as  preemptive  of  any  secondary  function. 
Sufficient  time  must  be  allocated  to  sample  all  parameters, 
update  those  currently  being  displayed,  compute  rates  of  change 
and  compare  these  and  current  values  to  maximum  rates  of  change 
or  value  limits,  respectively,  determine  what  faults  exist,  if 
any,  and  display  them  according  to  their  priority.  Adequate 
additional  time  per  cycle  should  be  available  for  secondary 
functions. 

The  test  for  fault  conditions  may  be  linked  to  flight  phase.  For 
example,  in  order  to  distinguish  between  an  engine  low  side  beep 
trim  failure  and  a  pilot  commanded  reduction  to  ground  idle 
power,  the  EMMADS  must  be  able  to  sense  the  position  of  the 
engine  condition  lever.  While  a  commanded  power  reduction  is 
normally  a  no-fault  condition,  during  airborne  operations  the 
placement  of  an  engine  condition  lever  in  a  ground  or  idle 
position  should  be  indicated  to  the  pilot.  It  could  be  considered 
as  a  fault  or  as  an  advisory,  but,  in  any  event,  it  is  a 
condition  which  warrants  an  information  display  to  the  pilot  and 
constitutes  a  link  with  flight  phase.  The  flight  phase  is  useful 
in  determining  the  operating  mode  for  the  measurement  of 
parameter  conditions,  as  part  of  the  EMMADS  primary  function. 
Under  various  operating  modes,  parameter  values  (conditions)  may 
or  may  not  be  abnormal,  as  shown  in  Appendix  1,  Subsystem 
Parameter  Data  Lists. 
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T  lere  are  two  fault  types  which  are  handled  by  the  EMMADS;  single 
parameter  faults  and  multiple  parameter  faults.  A  single 
parameter  fault  is  detected  by  examining  the  characteristics  of 
an  individual  parameter  (signal)  for: 

a.  An  out  of  tolerance  value,  or 

b.  An  out  of  tolerance  rate  of  change  (unfavorable  trend). 

A  multiple  parameter  fault  is  one  inferred  by  correlating  the 
values  of  various  related  parameters.  For  example,  to  properly 
identify  an  engine  failuri,  gas  producer  speed,  turbine  gas 
temperature,  torque  and  engine  oil  pressure  need  to  be  compared. 
Parameter  attributes,  (values  or  rates  of  change)  used  by  EMMADS 
as  standards  of  comparison  to  detect  «  ither  of  these  fault  types, 
are  set  by  the  operating  mode  mentioned  previously.  The  operating 
mode  may  be  determined  by  some  unrela  .ed  parameter  or  parameter 
group  (e.g.  when  gross  weight  sets  the  normal  rotor  rpm  limits). 

» 

Due  to  the  large  variations  in  the  size  and  configuration  of 
helicopters  studied,  the  classification  of  faults  and  the  related 
operating  modes  is  aircraft  specific.  An  example  of  a  fault  set, 
the  Fault/Parameter  Matrix  for  the  CH-47C,  is  shown  in  Appendix 
2.  This  matrix  relates  each  fault  to  a  set  of  parameters  which 
either  belong  to  a  specific  aircraft  subsystem  or  are  used  to 
relate  to  a  particular  operating  mode.  For  single  parameter 
faults  in  this  case,  the  Subsystem  Parameter  Data  List,  CH-47C, 
Appendix  1  illustrates  the  relationship  between  operating  modes 
and  various  parameter  conditions.  The  conditions  on  that  list  not 
classified  as  "normal"  constitute  fault  conditions.  For  multiple 
parameter  faults  the  operating  modes  and  conditions  are  obtained 
from  Chapter  9  of  the  Aircraft  Operator's  Manual. 
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I  Fault /Parameter  Display 

When  a  fault  is  detected,  the  pilot  must  be  made  aware  of  it.  The 
system  must  allow  the  pilot  to  control  what  is  on  the  display.  At 
the  same  time  he  must  be  given  information  about  new  faults  as 
they  occur.  A  priority  system  must  be  established  to  allow  the 
EMMADS  to  differentiate  between  faults  of  higher  and  lower 
relative  importance. 

In  establishing  such  a  fault  priority  structure,  it  is  important 
to  understand  the  information  requirements  when  a  fault  occurs 
during  a  specific  flight  situation.  The  first  task  of  the  pilot 
when  a  fault  occurs  is  to  regain/maintain  aircraft  control.  The 
second  task  is  to  take  whatever  action  is  necessary/possible  to 
correct  the  condition.  In  no  case  should  the  accomplishment  of 
the  second  task  interfere  with  the  first  task.  These  fundamental 
considerations  dictate  that  faults  be  divided  into  three  major 
categories : 

a)  Warnings  -  those  faults  whicn,  if  not  immediately  acted 
upon  by  the  crew,  wilfl.  most  likely  seriously  compromise 
the  pilot's  ability  to  control  the  aircraft  and 
therefore  could  result  in  personal  injury  or  loss  of 
life. 

b)  Cautions/Precautions  -  those  faults  which  do  not 
immediately  jeopardize  the  safety  of  the  crew  or  the 
ability  to  control  the  aircraft  but  which  may  result  in 
equipment  damage  if  not  attended  to.  In  addition,  such 
faults,  if  allowed  to  continue  without  corrective 
action  being  taken,  may  precipitate  one  or  more 
Warnings. 

c)  Advisories  -  these  are  conditions  (actually  parameter 
states)  the  pilot  should  be  made  aware  of.  The 
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determination  of  whether  or  not  these  states  are  faults 
is  left  to  the  pilot,  since  the  determination  of  the 
normal  conditions  depends  on  pilot  judgement  (e.g. 

Cargo  Hook  Open,  Parking  Brake  ON,  etc.) 

Given  the  faults  to  be  detected  (such  as  those  shown  in  the 
Fault/Parameter  Matrix  of  Appendix  2)  the  first  step  in 
prioritization  is  simply  to  designate  which  faults  fall  into  the 
Warning  category.  Then,  by  designating  the  conditions  which  are 
Advisories,  the  remaining  fault  conditions  fall  automatically 
into  the  Caution/Precaution  category. 

Such  a  fault  partitioning  scheme  as  applied  to  the  CH-47C  is 
shown  in  Table  1.  Placing  faults  into  the  Warning  category  was 
based  on  the  following  considerations: 

a)  A  total  loss  of  hydraulic  pressure  in  the  flight 
control  systems  makes  it  impossible  to  move  the  flight 
controls. 

b)  Rotor  rpm  is  directly  related  to  aircraft  lift,  so  loss 
of  rotor  rpm  requires  rapid  pilot  response. 

c)  In  a  dual  engine  aircraft,  given  a  choice  of  responding 
to  a  loss  of  engine  speed  control  versus  an  engine 
failure,  the  pilot  should  first  attend  to  the  engine 
that  is  still  operating. 

d)  Faults  in  any  subsystem  which  can  rapidly  precipitate 
loss  of  flight  controls,  loss  of  lift  or  loss  of  engine 
power  are  candidates  for  inclusion  in  the  Warnings  cate¬ 
gory.  Each  must  be  considered  on  an  individual  basis. 

In  assigning  the  specific  numeric  priorities  contained  in  Table  1, 
the  following  additional  considerations  were  taken  into  account: 


TABLE  1.  FAULT  PRIORITIZATION  FOR  THE  CH-47C  HELICOPTER 


Fault 

WARNINGS 

Quill  Shaft  Failure 

Rotor  RPM  Limit  (continuous  display) 
No.  1  Engine  Beep  Trim 
High  Side  Failure 
No  2.  Engine  Beep  Trim 
High  Side  Failure 
No.  1  Engine  N2  Sensing  Failure 

No.  2  Engine  N2  Sensing  Failure 

No.  1  Engine  Beep  Trim 

Low  Side  Failure 
No.  2  Engine  Beep  Trim 
Low  Side  Failure 
No.  1  &  2  Engines  Failed 
No.  1  Engine  Failed 

No.  2  Engine  Failed 

No.  1  Flight  Control  Hydraulic  Press 

Low/Rate 

No.  2  Flight  Control  Hydraulic  Press 
Low/Rate 

Eng.  1  &  2  Fuel  Boost  Press  Limit 
(PA  >6000') 

Eng.  1  Fuel  Boost  Press  Limit 
(PA  >6000' ) 

Eng.  2  Fuel  Boost  Press  Limit 
(PA  >6000') 

No.  1  and  2  SAS  OFF 


Subsystem 

Displayed  Priority 


Hydraulic  1 

Engine  2 

Engine  3 

Engine  3 

Engine  3 

Engine  3 

Engine  4 

Engine  4 

Engine  4 

Engine  5 

Engine  5 

Hydraulic  6 

Hydraulic  6 

Fuel  7 

Fuel  8 

Fuel  8 


Miscellaneous  9 


CAUT IONS / PREC AUT IONS 


Eng.  1 

PTIT  Lirait/Rate  (starting 

only ) 

Engine 

10 

Eng.  2 

PTIT  Lirait/Rate  (starting 

only) 

Engine 

10 

Eng.  1 

Torque  Limit  (continuous 

display) 

Engine 

10 

Eng.  2 

Torque  Limit  (continuous 

display) 

Engine 

10 

Eng.  1 

N1  Limit 

Engine 

10 

Eng.  2 

Ni  Limit 

Engine 

10 

Eng.  1 

Oil  Press  Limit/Rate 

Engine 

10 

Eng.  2 

Oil  Press  Limit/Rate 

Engine 

10 

Eng.  1 

Oil  Temp  Limit /Rate 

Engine 

10 

Eng.  2 

Oil  Temp  Limit/Rate 

Engine 

10 

Eng.  1 

Chip  Detected 

Engine 

10 

Eng.  2 

Chip  Detected 

Engine 

10 

13 
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TABLE  1. 

FLIGHT  PRIORITIZATION  FOR  THE  CH-47C  HELICOPTER  (cont'd) 


Fault 

CAUTIONS/PRECAUTION  (cont'd) 

Eng.  1  Oil  Level  Limit 

Eng.  2  Oil  Level  Limit 

Eng.  1  Ni  Control  Loop  Energized 

Eng.  2  Ni  Control  Loop  Energized 

Fuel  Qty-Left,  Fwd  Limit/Rate 
Fuel  Qty-Left,  Main  Limit/Rate 
Fuel  Qty-Left,  Aft  Limit/Rate 
Fuel  Qty-Right,  Fwd  Limit/Rate 
Fuel  Qty-Right,  Main  Limit/Rate 
Fuel  Qty-Right,  Aft  Limit/Rate 
Eng.  1  Fuel  Boost  Press  Limit 
(PA  <6000') 

Eng.  2  Fuel  Boost  Press  Limit 
(PA  <6000' ) 

Fuel  Boost  Press,  Left,  Fwd  Limit 
Fuel  Boost  Press,  Left,  Aft  Limit 
Fuel  Boost  Press,  Right, Fwd  Limit 
Fuel  Boost  Press,  Right, Aft  Limit 
Eng.  1  Fuel  Flow  High 
Eng.  2  Fuel  Flow  High 

Eng.  1  Xmsn  Oil  Press  Limit/Rate 
Eng.  2  Xmsn  Oil  Press  Limit/Rate 
Combining  Xmsn  Oil  Press  Limit/Rate 
Fwd  Xmsn  Oil  Press  Limit/Rate 
Aft  Xmsn  Oil  Press  Limit/Rate 
Eng.  1  Xmsn  Oil  Temp  Limit/Rate 
Eng.  2  Xmsn  Oil  Temp  Limit/Rate 
Combining  Xmsn  Oil  Temp  Limit/Rate 
Fwd  Xmsn  Oil  Temp  Limit/Rate 
Aft  Xmsn  Oil  Temp  Limit/Rate 
Combining  Xmsn  Chip  Detected 
Fwd  Xmsn  Chip  Detected 
Aft  Xmsn  Chip  Detected 
Aft  Thrust  Bearing  Chip  Detected 

No.  1  Generator  Load  Limit 
No.  2  Generator  Load  Limit 
No.  1  &  2  Generators  Failed 
No.  1  Rectifier  Load  Limit 
No.  2  Rectifier  Load  Limit 
No.  1  h  2  Rectifiers  Failed 
AC  Bus  X-Tie  Failure 
DC  Bus  X-Tie  Failure 


Subsystem 
Displayed  Priori 


Engine 

10 

Engine 

10 

Engine 

10 

Engine 

10 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Fuel 

11 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Powertrain 

12 

Electrical 

13 

Electrical 

13 

Electrical 

13 

Electrical 

13 

Electrical 

13 

Electrical 

13 

Electrical 

13 

Electrical 

13 

14 


TABLE  1 

FAULT  PRIORITIZATION  FOR  THE  CH-47C  HELICOPTER  (Cont'd) 


Fault 


CAUTIONS/PRECAUTIONS  (Cont'd) 

No.  1  Flight  Control  Hydraulic 
Press  High 

No.  2  Flight  Control  Hydraulic 
Press  High 

Utility  Hydraulic  Press  Limit/Rate 
Utility  Hydraulic  Temp  Limit 
APU  Accumulator  Press  Limit 


Subsystem 

Displayed  Priority 


Hydraulic  14 

Hydraulic  14 

Hydraulic  14 

Hydraulic  14 

Hydraulic  14 


No.  1  SAS  OFF 
No.  2  SAS  OFF 

Fwd  Cyclic  Trim  Actuator  Position  Limit 
Aft  Cyclic  Trim  Actuator  Position  Limit 
Right  Aft  Landing  Gear  Phase  Limit 
Heater  Output  Temperature  Limit 


Miscellaneous  15 
Miscellaneous  15 
Miscellaneous  15 
Miscellaneous  15 
Miscellaneous  15 
Miscellaneous  15 


ADVISORIES 


AC  External  Power  Connected 
DC  External  Power  Connected 
Parking  Brake  On/Off 
Cargo  Hook  Open/Closed 
APU  On/Off 


Electrical  16 
Electrical  16 
Miscellaneous  16 
Miscellaneous  16 
Miscellaneous  16 
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a)  If  similar  faults  can  occur  in  more  than  one  area  of 
the  same  subsystem,  then  there  is  no  difference  in 
their  priority  unless  all  such  faults  occur  in  com¬ 
bination  (e.g.,  a  flameout  in  one  engine  is  just  as 
serious  as  a  flameout  in  the  other  engine,  but  a  flam¬ 
eout  in  both  engines  is  more  serious). 

b)  Faults  that  are  mutually  exclusive  can  be  assigned  the 
same  level  of  priority.  For  example,  a  given  engine 
cannot  simultaneously  experience  a  beep  trim  high  side 
and  low  side  failure. 

c)  In  assigning  general  priorities  within  the  Caution/ 
Precaution  category,  it  is  more  reasonable  to  assign 
priorities  based  on  the  subsystems  wherein  the  faults 
reside,  as  opposed  to  assigning  priorities  on  an  indi¬ 
vidual  basis  (except  in  the  case  of  those  faults  in  the 
"Miscellaneous"  subsystem). 

This  last  point  may  not  seem  realistic  until  one  one  realizes 
that  all  of  the  immediate  action  (Warning  category)  faults  are 
removed  first  and  the  remaining  faults  (Not  Advisories)  all 
require  a  pilot  reaction  of  about  the  same  level  of  urgency. 

Given  that  the  pilot  is  going  to  acknowledge  all  faults  in  a 
reasonably  short  time  and  that  he  will  be  alerted  when  any  fault 
occurs,  the  prioritization  according  to  subsystem  importance  is 
the  simplest  and  most  logical  procedure  to  follow. 

Highest  on  the  list  of  Cautions/Precautions  should  be  the  Engine 
subsystem  since  the  engines  provide  the  power  to  stay  aloft.  This 
is  followed  by  the  Fuel  subsystem  because  it  directly  affects  the 
ability  of  the  engines  to  continue  operating.  Next  comes  the 
Powertrain  subsystem  (minus  the  continuously  displayed  rotor  rpm) 
since  it  is  probable  that  there  will  be  a  larger  time  span  within 
which  to  react  to  a  fault  in  this  subsystem  as  opposed  to  faults 
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in  the  two  subsystems  just  listed.  (For  example,  transmissions 
have  been  designed  to  run  as  long  as  30  minutes  with  no  oil  in 
the  sump.)  Following  this  would  be  the  Electrical  and  Hydraulic 
subsystems,  respectively.  (Keep  in  mind  that  major  flight  control 
hydraulic  faults  are  already  included  in  the  Warning  category.) 
Finally,  all  remaining  faults  are  prioritized  according  to 
estimated  relative  urgency  in  the  Miscellaneous  subsystem.  At 
this  time,  no  further  prioritization  has  been  deemed  necessary. 

It  is  possible  that  future  considerations  may  indicate  that  some 
faults  in  one  subsystem  should  really  have  the  same  priority  as 
faults  in  another  subsystem,  insofar  as  the  urgency  of  the 
desired  crew  reaction  is  concerned.  Determinations  of  this  type 
can  be  made  only  after  a  prototype  system  has  been  used  to  gather 
specific  aircrew  recommendations  under  suitable  test  conditions. 

The  final  subcategory,  which  has  not  yet  been  addressed,  is  that 
of  Advisories.  When  an  advisory  level  condition  occurs,  it  is 
generally  a  state  change  of  a  discrete  sensor.  It  has  the  lowest 
display  priority.  Hence  advisory  state  changes  will  be  displayed 
only  if  no  faults  take  display  priority.  In  the  case  of  the 
CH-47C  used  as  an  example  in  Table  1,  there  are  five  advisory 
conditions  currently  identified:  AC  External  Power,  DC  External 
Power,  Parking  Brake  Status,  Cargo  Hook  Status  and  APU  On/Off 
Status. 

Given  the  preceeding  discussion  as  background,  the  system  opera¬ 
tion  with  regards  to  fault  detection  and  display  may  now  be  dis¬ 
cussed.  As  previously  described,  with  no  faults  active,  the 
display  is  clear  except  for  Rotor  rpm,  Torque  and  Remaining 


Flight  Time,  as  shown  in  Figure  3.  If  a  fault  is  detected,  the 
following  events  take  place: 
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The  aircraft  Master  Caution  light  is  illuminated  by  the 
EMMADS  computer. 

EMMADS  determines  the  highest  priority  fault  using  the 
priority  structure  of  Table  1  and  displays  the  raw  data 
of  the  subsystem  related  to  that  fault  in  the  Subsystem 
Data  Area.  Figure  4  shows  an  example  of  this  for  the 
case  of  a  failure  of  the  number  2  engine.  Note  that  the 
out  of  tolerance  parameters  are  indicated  by  the  use  of 
oversized  symbology.  The  fact  that  the  symbols  are 
filled  in  indicates  that  an  operational  limit  has  been 
exceeded.  Note  also  that  if  other  faults  existed  in  the 
same  subsystem,  they  would  likewise  appear  even  though 
they  might  be  of  lower  priority  than  the  fault  which 
brought  about  the  display  of  that  subsystem.  The 
symbols  are  flashing  because  they  are  part  of  a  fault 
which  is  not  yet  acknowledged.  Also,  the  subsystem 

r ' 

name  "ENG"  in  the  upper  left  of  the  Dedicated  Status 
Area  is  flashing  because  there  is  an  unacknowledged 
fault  in  that  subsystem.  Note  that  the  MLDS  previously 
labeled  "ENG  DATA"  now  reads  "ENG  ACK"  and  the  right 
most  switch  now  reads  "WARN  ACK". 

When  a  Warning  is  detected,  an  appropriate  message  is 
displayed  in  the  Warning  Message  Area.  (In  the  case  of 
the  example  in  Figure  4,  the  engine  failure  results  in 
the  message  ENG  2  OUT  being  displayed.)  A  box  around 
the  message(s)  indicates  the  highest  priority 
warning(s)  displayed.  These  highest  priority  warning 
messages  are  located  in  the  top  row  of  the  Warning 
Message  Area.  The  messages  have  positional 
significance:  left  and  right  of  center  if  they  pertain 
to  engine  or  system  numbers  1  &  2  respectively  or 
centered  when  no  such  symmetry  considerations  exist 
(e. g. ,  rotor  rpm) . 
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Figure  4.  Sample  Display  Format  -  Fault  Detected 


c)  The  pilot  must  manually  acknowledge  that  he  has 
reviewed  the  faults  in  the  displayed  subsystem,  using  a 
cyclic  mounted  acknowledge  switch  or  the  MLDS  labeled 
"ENG  ACK"  or  "WARN  ACK"  as  described  in  Section 

3. 2. 1.4.  Actuation  of  either  of  these  switches 
acknowledges  the  highest  priority  Warning  and  results 
in  the  appropriate  emergency  procedures  checklist  being 
placed  on  the  display  together  with  or  instead  of  the 
subsystem  data.  Figure  5  illustrates  this  transition 
for  the  example  started  in  Figures  2  and  3.  This  first 
actuation  of  the  acknowledge  switch  also  extinguishes 
the  Master  Caution  Light. 

d)  The  pilot  notifies  EMMADS  of  checklist  completion  using 
the  acknowledge  function.  In  the  example  used  in  Figure 
5,  no  other  faults  existed  and  the  failed  engine 
checklist  has  been  acknowledged  so  the  display  format 
would  change  to  that  shown  in  Figure  6.  Note  that  the 
word  ENG  is  now  steadily  illuminated  in  the  upper  left 
hand  corner,  indicating  that  the  engine  fault,  although 
acknowledged,  still  exists. 

An  important  distinction  should  be  made  regarding 
acknowledgement  of  Warnings  versus  other  faults.  The 
acknowledge  (ACK)  switch  on  the  flight  control  will 
acknowledge  Warnings  separately.  Once  all  Warnings  are 
acknowledged,  all  remaining  faults  are  acknowledged  by 
subsystem.  Thus,  an  engine  display  with  two  or  more 
"non-Warning"  type  faults  will  be  cleared  by  actuating 
the  ACK  switch  once.  This  allows  the  pilot  to  rapidly 
review  all  faults  while  keeping  his  hands  on  the  flight 
controls. 
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Figure  5.  Sample  Display  Format  -  Warning  Acknowledged, 
Checklist  Displayed 
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The  previous  example  did  not  address  the  question  of  what  happens 
when  a  fault  of  lower  priority  is  displaced  by  a  high  priority 
fault.  This  can  occur  in  two  ways:  the  lower  priority  fault 
occurs  first  and  then  the  high  priority  fault  masks  it  or  the  low 
priority  fault  occurs  while  the  pilot  is  still  dealing  with  the 
high  priority  fault.  In  either  case,  the  name  of  the  subsystem 
in  which  the  low  priority  fault  resides  will  appear,  flashing,  in 
the  top  left  of  the  Dedicated  Status  Area,  to  indicate  that  an 
active  fault(s),  not  yet  acknowledged,  exists  in  that  subsystem. 

Another  element  of  the  fault  display  not  yet  discussed  has  to  do 
with  the  amount  of  time  remaining  when  a  parameter  is  operating 
in  a  time  limited  range.  This  information  also  appears  in  the 
Dedicated  Status  Area,  as  a  Timed  Parameter  Limit  Clock  located 
under  the  Remaining  Flight  Time  indicator.  The  logic  governing 
the  use  of  this  Timed  Parameter  Limit  Clock  dictates  that  it's 
display  requires  a  priority  system  different  from  that  employed 
for  fault  display.  From  both  an  operational  and  a  human  factors 
standpoint,  the  major  considerations  in  establishing  such  a 
priority  system  are: 

a)  The  pilot  is  capable  of  taking  action  on  only  one 
countdown  at  a  time,  and 

b)  The  pilot  will  concentrate  on  the  countdown  with  the 
least  time  to  go. 

Based  on  this,  it  is  logical  to  display  only  one  countdown  at  a 
time;  the  one  with  the  least  time  remaining.  However,  there  may 
be  some  parameters  with  timed  operating  ranges  the  pilot  can 
control  directly  and  others  he  cannot.  In  this  case,  the  display 
priority  for  remaining  time  is  in  two  major  divisions,  with 
actively  controlled  parameters  having  priority  over  those  that 
are  not.  Within  each  of  these  two  categories,  the  least  time 
remaining  criteria  applies  for  display  priority. 
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As  an  example  of  the  total  amount  of  information  which  must  be 
processed  for  this  mode  the  parameters  on  the  CH-47C  that  have 
timed  operating  limits  include  Rotor  RPM,  Torque,  PTIT  and  Engine 
Gearbox  Oil  Temperature.  (See  Subsystem  Parameter  Data  List, 
CH-4C,  Appendix  1.)  Thus,  the  first  three  are  placed  in  the 
higher  (actively  controlled)  display  category,  and  their 
countdowns  have  priority  over  that  of  the  Engine  Gearbox  Oil 
Temperature. 

3. 2. 1.4  Multilegend  Display  Switch  ( MLDS )  Operation 

The  aircrew  has  the  capability  of  selecting  raw  data  for  display, 
by  subsystem,  using  a  series  of  MLDS's  located  adjacent  to  the 
display  panel.  Several  factors  governing  their  operation  should 
be  noted: 

a)  Whenever  the  format  on  the  EMMADS  display  is  not  one 
seen  under  "normal"  operating  conditions  (i.e.,  only 
the  Dedicated  Status  Area  appears)  the  right  most 
switch  marked  "STAT  ONLY"  is  available  to  allow  the 
pilot  to  return  the  display  back  to  the  Dedicated 
Status  Area  only. 

b)  This  same  switch  is  used  to  modify  the  operating  mode 
of  all  the  other  switches,  by  changing  their  legends 
simultaneously.  This  results  in  three  major  levels  of 
switch  operation:  Data/Emergency  Procedures,  Routine 
Checklists  and  Performance  Calculations. 

c)  Switch  actuation  will  change  the  display  only  if  there 
is  no  conflict  with  the  fault  detection  and  display 
algorithms,  which  have  priority. 

There  are  two  modes  of  operation  possible  for  the  MLDS's  Manual 
Display  Command  operations  and  Fault  Related  Operations. 


3. 2. 1.4.1  MLDS  Operations  -  Manual  Display  Command 

Under  normal  conditions,  with  no  faults  displayed,  the  seven 
MLDS's  immediately  below  the  display  bear  the  legends  shown  in  of 
Figure  7a.  Actuation  of  any  one  of  the  first  six  switches  places 
the  data  for  the  selected  subsystem  on  the  EMMADS  display  and 
changes  the  legend  of  the  depressed  switch  and  the  right-most 
switch  as  shown  in  the  figure.  The  set  of  MLDS  legends  in  Figure 
7a  then  represents  the  system  being  in  the  Subsystem  Information 
Level.  The  result  of  depressing  a  switch  with  a  "PROC”  label  is 
that  the  subsystem  data  is  replaced  by  the  first  page  of  the 
highest  priority  emergency  procedures  checklist  applicable  to 
that  subsystem.  Successive  actuations  of  that  switch  will  result 
in  the  sequential  display  of  all  such  checklists  remaining. 
Depressing  the  "PROC"  switch  one  more  time  when  the  last 
checklist  is  on  the  screen  clears  the  display  except  for  the 
Dedicated  Status  Area  and  returns  all  switch  legends  to  the 
original  set  shown  in  Figure  7a.  For  Figures  7b-7g,  depressing 
any  switch  other  than  the  one  with  the  "PROC"  or  the  "STAT  ONLY" 
legends  will  have  no  effect. 

The  legends  may  be  changed  simultaneously  to  the  Routine 
Checklist  Level  by  depressing  the  "CHCK  LSTS"  switch,  as  shown  in 
Figure  8.  This  also  clears  the  display  except  for  the  Dedicated 
Status  Area.  The  six  left-most  switches  now  provide  for  selection 
of  various  routine  checklists,  to  be  displayed  in  the  combined 
Warning  Message  and  Subsystem  Data  Areas.  As  shown  in  Figure  9, 
depressing  any  of  the  first  six  switches  changes  the  legend  of 
that  switch  and  the  right-most  switch,  as  well  as  presenting  the 
first  page  of  that  checklist  on  the  display.  For  example,  in 
Figure  9c,  the  Normal  Starting  Engines  checklist  is  selected 
("NORM  STRT "  depressed).  Depressing  that  same  switch  again  (now 
labeled  "MTF  STRT"  in  the  example  shown)  calls  up  a  different 
checklist  for  display  and  would  change  that  switch  legend  back  to 
the  previous  one  ("NORM  STRT").  All  of  the  first  six  switches 
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Figure  7.  MLDS  Functions  -  Subsystem  Information  Level 
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A  Display  Unn  and  MULS  after  selection  of 
Routine  Checklists  level  (See  Figure  2-6 b) 


B  Emergency  Start  Checklist  selected  (Final 
Format  TBS) 

C  Normal  Start  Checklist  selected  (Final 
Format  TBS  -  Sample  Format  shown, 
with  several  items  already  completed) 

D  Before  Take  Off  Checklist  selected 
(Final  Format  TBS) 

E  Cruise  Checklist  selected  (Final  Format 
TBS) 

F  Before  Landing  Checklist  selected  (Final 
Format  TBS) 

G.  Engine  Shutdown  Checklist  selected 
(Final  Format  TBS) 
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Figure  9.  MLDS  Operation  - 

Routine  Checklists  Level 
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(except  "EMER  STRT")  operate  in  a  similar  manner,  as  shown. 


Depressing  the  switch  labeled  "PERF  CALC"  changes  the  switch 
legends  as  shown  in  Figure  8c  while  simultaneously  clearing  the 
display,  except  for  the  Dedicated  Status  Area.  This  figure  shows 
that  depressing  the  7  "LMTS  SUMM"  switch  changes  the  legend  of 
that  switch  only.  This  is  true  of  all  the  other  switches  as  well, 
with  no  change  in  the  legends  of  the  first  six  switches.  The 
"LMTS  SUMM"  switch  displays  the  Limits  Summary  data  which  is  used 
for  post-flight  maintenance  playback  of  faults.  Other  switches 
select  various  performance  calculations  for  display  (see  Section 
3. 2. 2. 2) 

The  only  function  not  yet  described  is  that  of  the  "STAT  ONLY" 
switch.  Figure  8d  shows  that  no  mattei  what  legends  appear  on  the 
first  six  switches,  depressing  the  "SI  AT  ONLY"  switch  always 
returns  the  switch  legends  to  those  of  the  Subsystem  Information 
Level  and  clears  the  display  except  fcr  the  Dedicated  Status 
Area. 


3. 2. 1.4. 2 


MLDS  Operations  -  Fault  Related 


In  the  case  where  a  fault  is  being  displayed,  the  switch  normally 
associated  with  the  displayed  subsystem  has  it's  legend  changed 
to  "XXXX  ACK",  where  "XXXX"  represents  the  subsystem  name.  This 
switch  function  now  exactly  duplicates  that  of  the  ACK  switch  on 
the  flight  control.  The  switch  legends  revert  back  to  those  of 
Figure  7a  when  all  faults/eraergency  procedure  checklists  are 
acknowledged.  If  Warning  Messages  are  displayed,  the  legend  of 
the  right-most  switch  will  also  be  changed  to  "WARN  ACK".  The 
pilot  has  the  option  of  using  this  switch  to  simultaneously 
acknowledge  all  Warnings,  as  opposed  to  acknowledging  each  one 
separately.  This  would  also  bypass  the  automatic  display  of  each 
emergency  procedures  checklist  associated  with  those  Warnings. 
These  checklists  would  then  be  selectable  later  using  the  "XXXX 
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PROC"  switches.  Once  the  "WARN  ACK”  switch  is  depressed,  its 
legend  reverts  to  "CUCK  LSTS". 

The  switches  described  above  are  the  only  ones  actually  changed 
when  faults  are  being  displayed.  All  others  retain  their  original 
legends  but  will  do  nothing  if  depressed. 

A  description  of  the  switch  legends  is  included  in  Table  2. 

3 . 2 . 1 . 5  Emergency  Action  Checklists 

The  display  of  emergency  action  checklists  is  accomplished 
through  two  mechanisms: 

a)  Checklists  associated  with  Warning  type  faults  are  auto¬ 
matically  displayed  after  an  acknowledge  switch  other 
than  "WARN  ACK"  is  actuated, 

b)  All  checklists  may  be  accessed  using  the  relegendable 
switches  marked  "PROC"  as  described  in  Section  3. 2. 1.4. 

After  the  acknowledgement  of  an  individual  Warning,  the 
associated  emergency  action  checklist  is  displayed,  utilizing 
formats  (TBS)  supplied  by  Human  Factors  Engineering.  The 
checklists  are  manually  acknowledged  and  are  completed  item  by 
item  in  the  same  manner  as  the  routine  interactive  checklists 
discussed  later  in  Section  3. 2. 2.1.  Upon  completion  of  a 
checklist,  the  subsystem  for  the  next  highest  priority  Warning 
appears.  The  Warning  Message  is  boxed  in  (see  Figure  3)  and  it's 
checklist  may  then  be  displayed  in  a  like  manner.  If  there  are  no 
more  Warnings,  the  subsystem  with  the  next  highest  priority 
fault(s)  is  displayed.  To  access  emergency  checklists  in  a  given 
subsystem,  depressing  the  "PROC"  switch  (after  all  faults  have 
been  acknowledged)  changes  the  "PROC"  to  "ACK"  and  causes  EMMADS 
to  display  the  checklist  for  the  highest  priority,  active  fault 
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TABLE  2.  SWITCH  LEGEND  DESCRIPTIONS 


i 


i 

[ 


i 

f 


Legend 
(XXXX)  DATA 

CHCK  LSTS 
(XXXX)  PROC 

STAT  ONLY 

KMER  STRT 
NORM  STRT 

T/O  CHCK 

CKSE  CHCK 

LNDG  CHCK 

SHUT  DOWN 

PERF  CALC 


Description 

Raw  sensor  data  is  displayed  for  the  subsystems 
designated  by  "XXXX"  -  i.e.,  the  Engine,  Fuel, 
Transmission,  Electrical,  Hydraulic  and  Miscel¬ 
laneous  subsytems.  (Formats  other  than  Engine 
Subsystem  TBS) 

Checklists  switch  legends  will  be  selected 

Emergency  procedures  (checklists)  are  displayed 
for  the  subsystems  designated  by  "XXXX"  (as 
described  above  for  DATA  legends.  Formats  TBS) 

Display  cleared  except  for  the  Dedicated  Status 
Area  (see  Figure  8). 

Emergency  Start  checklist  will  be  displayed.  (TBS) 

Normal  Start  checklist  will  be  displayed,  (see 
Appendix  4) 

Before  Takeoff  checklist  will  be  displayed,  (see 
Appendix  4) 

Cruise  checklist  will  be  displayed,  (see 
Appendix  4) 

Before  Landing  checklist  will  be  displayed,  (see 
Appendix  4) 

Engine  Shutdown  checklist  will  be  displayed,  (see 
Appendix  4) 

Performance  Calculation  switch  legends  will  be 
selected. 


MTF  (XXXX) 


HIT  CHCK 

HVR  PWR 

MAX  PWR 


Maintenance  Test  Flight  versions  of  the  checklists 
designated  by  "XXXX"  will  be  selected 
(provisional ) . 

(Engine)  Health  Indicator  Test  calculation  will  be 
displayed,  (see  Section  3. 2. 2. 2) 

Power  Required  to  Hover  (IGE  and  OGE)  calculation 
will  be  displayed,  (see  Section  3. 2. 2. 2) 

Maximum  Available  Power  calcuation  will  be 
displayed,  (see  Section  3. 2. 2. 2) 
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TABLE  2.  SWITCH  LEGEND  DESCRIPTIONS  (CONT) 


Legend 
WT  &  BAL 

SYST  TEST 

LMTS  SUMM 

(XXXX)  ACK 

WARN  ACK 


Description 

Weight  and  Balance  Calculation  will  be  displayed, 
(see  Section  3. 2. 2. 2) 

System  Self  Test  will  be  initiated  and  displayed 
( provisional ) . 

Limits  Summary  will  be  displayed  (maintenance  data 
summarized  -  post-flight  operation.  See  Section 
3 . 2 . 2 . 3 .  ) 

Duplicates  acknowledge  switch  function  for  faults 
in  subsystem  described  by  "XXXX".  The  "XXXX" 
portion  of  the  legend  also  reflects  the  subsystem 
being  displayed  (with  unacknowledged 
faults/emergency  procedures  checklists). 

Simultaneously  acknowledges  all  currently  active 
Warnings. 


33 


in  that  subsystem,  provided  the  checklist  has  not  been  completed 
since  fault  detection.  If  there  are  none,  the  switch  retains  it's 
"PROC"  legend  and  allows  a  review  of  all  checklists  for  that 
subsystem,  as  previously  described  in  Section  3.2. 1.4.1.  Upon 
completion  of  one  checklist,  the  next  highest  priority  one  is 
automatically  displayed.  If  no  more  exist,  the  display  is  cleared 
and  the  switch  iegend  returns  to  "DATA"  as  shown  in  Figure  8a. 

An  emergency  checklist  for  a  Warning  may  not  be  removed  from  the 
display  unless: 

a)  The  checklist  is  acknowledged  as  complete  by  using  the 
ACK  switch  on  "XXXX  ACK"  MLDS . 

b)  A  higher  priority  fault  is  detected. 

c)  The  fault  related  to  the  checklist  is  cleared. 

A  complete  list  of  the  emergency  procedures  checklists  associated 
with  the  CH-47C  is  shown  in  Table  3.  Before  any  such  checklists 
are  incorporated  into  EMMADS ,  they  must  be  rewritten  observing 
the  following  criteria: 

a)  Checklists  consisting  of  so  called  "immediate  action" 
items  will  be  displayed  with  the  idea  that  they  will  be 
used  by  the  pilot,  after  he  has  already  completed  the 
items,  to  verify  completion.  This  is  because  the 
required  speed  of  reaction  does  not  allow  time  to  "read 
and  respond"  to  such  items,  as  the  aircraft  operator's 
manuals  currently  indicate. 

b)  Other  checklists  (or  portions  thereof)  that  have  no 
immediate  action  items  but  which  provide  for  natural 
follow  on  responses  to  them  will  be  appended  to  those 
immediate  action  items  (e.g. ,  Engine  Cleanup  and 
Restart  combined  with  Engine  Failure  checklist). 
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c)  Where  applicable,  these  checklists  will  be  displayed 

along  with  any  raw  data  necessary  for  checklist  accom¬ 
plishment  (e.g..  Engine  Restart  shown  with  an(j  TGT). 
Formats  are  TBS  pending  final  results  of  a  human 
factors  study. 

A  suitably  rewritten  version  of  the  checklists  in  Table  3  is  TBS. 
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TABLE  3.  CH-47C  EMERGENCY  ACTION  CHECKLISTS 


Checklist 


Related 

Fault(s)* 


1.  Failure  of  Two  Engines  - 
Low  Altitude/Low  Airspeed 

61 

2.  Failure  of  Two  Engines  - 
Cruise 

61 

3.  Failure  of  One  Engine  - 
Low  Altitude/Low  Airspeed 

60 

4.  Failure  of  One  Engine  - 
Cruise 

60 

5.  Engine  Restart  During  Flight 

60, 

61 

6.  Engine  Cleanup  Procedure 

60, 

61 

7.  Normal  Engine  Beep  Trim  System 
Failure  -  High  Side 

62, 

63 

8-  n2  Governor  Failure 

64, 

65 

9.  Normal  Engine  Beep  Trim  System 
Failure  -  Low  Side 

66, 

67 

10.  Engine  Shutdown  -  Complete 
Electrical  Failure 

71 

11.  Engine  Residual  Fire  During 

Starting  and  Shutdown 

3, 

4  (Rate  Trigger) 

12.  Engine  Fire  -  Ground 

3, 

4  (Rate  Triger) 

13.  Single  Fuel  Pump  Failure 

25, 

25. 

27, 

28 

14.  Fuel  Cell  Overpressure 

17, 

19, 

20, 

22,  68,  69 

15.  Fuel  Pump  System  Failure 

23, 

24 

16.  Fuel  Low  and  One  or  Both 

Aft  Pumps  Inoperative 

17- 

22, 

26, 

28 

17.  Failure  of  Both  Generators 

71 

18.  Failure  of  Both  Transformer 
Rectifiers 

72 

• 
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TABLE  3.  CH-47C  EMERGENCY  ACTION  CHECKLISTS  (Cont'd) 


Checklist 


19.  Failure  of  One  Flight  Control 
Hydraulic  System 

20.  Failure  of  Both  Flight  Control 
Hydraulic  Systems 

21.  Longitudinal  Cyclic  Trim  Failure 

22.  Single  SAS  Failure 

23.  Dual  SAS  Failure 


*  See  Appendix  2  -  Fault/Advisory  List 


Related 

Fault(s)* 

44,45 

70 

53,  54 
55,  56 
73 
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3.2.2  System  Secondary  Functions 

3.2.2. 1  Routine  Checklists 

The  EMMADS  secondary  functions  are  related  to  the  flight  phases. 
It  is  convenient  to  define  the  time  span  from  system  power-up  to 
power-down  as  a  flight.  Each  flight,  in  turn,  may  be  divided  into 
a  number  of  sorties  where  a  sortie  begins  with  a  take-off  (from 
the  ground  or  from  hover  to  forward  flight)  and  ends  with  a 
landing  (to  a  hover  or  to  the  ground).  The  EMMADS  may  then  be 
envisioned  as  normally  cycling  through  various  states  based  on 
the  stage  of  flight.  The  current  operational  state  is  described 
by  the  particular  routine  checklist  which  the  system  is  currently 
running  or  last  finished  running.  The  checklists  applicable  to 
the  CH-47C  are  shown  in  Table  4,  including  a  set  of  operating 
conditions  (called  modification  parameters)  that  modify  the 
indicated  checklists.  The  flight  state  numbers  shown  next  to  each 
checklist  are  used  in  Figure  10  to  indicate  how  the  EMMADS  would 
progress  from  state  to  state  in  any  flight.  It  should  be  noted 
that  it  would  be  quite  natural  to  regroup  these  checklists  into 
the  categories  illustrated  in  Figure  9. 

In  Figure  10,  a  method  of  communicating  flight  state  changes  to 
EMMADS  is  shown.  Differentiation  is  made  between  two  methods  of 
progression  from  one  state  to  the  next.  The  sequential  state 
change  paths  could  be  brought  about  through  the  use  of  the  ACK 
switch.  As  EMMADS  moves  to  a  new  flight  state,  the  associated 
routine  checklist  could  be  displayed.  After  the  last  item  in  a 
given  checklist  is  completed,  (provided  there  are  no  faults 
requiring  acknowledgement)  actuation  of  the  ACK  switch  would 
enable  the  next  checklist  in  the  sequence  shown. 

The  specifically  directed  state  change  paths  indicate  that  the 
crew  must  make  some  other  input  to  the  system  to  produce  the 


38 


TABLE  4.  CH-47C  ROUTINE  CHECKLISTS  AND  MODIFICATION  PARAMETERS 


Routine  Checklists 


State 


Checklist  Title 


1  Before  Starting  Engines 

2  Starting  Engines 

3  Engine  Ground  Operation 

4  Before  Taxi 

5  Taxiing  Check 

6  Before  Takeoff  (to  a  hover)* 

7  Hover  Check 

8  Before  Takeoff  (to  forward  flight)* 

9  Cruise  Check 

10  Before  Landing 

11  After  Landing 

12  Engine  Shutdown 

*  (These  checklists  are  identical  in  TM  55-1520-237-10-2.  They 
are  listed  separately  here  in  order  to  differentiate  between 
two  distinct  flight  modes.) 

Modification  Parameters 


Parameter 


Affected  Checklists' 


1.  Through-Flight  Operation 
with  crew  change 


Before  Starting  Engines 
Starting  Engines 
Engine  Ground  Operation 


2.  External  Cargo 
Operation 


Before  Taxi 
Before  Takeoff  (8) 
Cruise 

Before  Landing 


3.  Night  Flight  Operation 


Starting  Engines 
Engine  Ground  Operation 
Hover  Check 


4.  Instrument  Flight 
Operation 


Starting  Engines 
Engine  Ground  Operation 
Hover  Check 


5.  Water  Operation 


Before  Taxi 
Before  Landing 


6.  Cold  Weather  Operation 


Starting  Engines 


7.  Hot  Weather  Operation 

8.  Maintenance  Test  Flight 
Operation 


Engine  Shutdown 

All  (except  Before  Takeoff  and 
Before  landing) 
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Power-Up 
(APU  Started) 


♦ 

Power-Down 


Sequential  State  Change  Path 
-*■  Specifically  Directed  State  Change  Path 


Figure  10.  Normal  Operational  State  Sequence 


indicated  state  change.  This  would  accomplished  by  using  one  of 
the  MLDS's  described  in  Section  3. 2. 4.1. 


The  sequential  state  change  operating  scheme  would  make  it  easy 
for  the  pilot  (without  removing  his  hands  from  the  flight 
controls)  to  display  and  accomplish  those  checklist  items  most 
often  used  in  helicopter  operations;  Before  Takeoff  and  Before 
Landing.  This  is  a  particularly  useful  feature  for  both 
operational  and  training  type  missions,  where  multiple  takeoffs 
and  landings  are  the  rule. 

Given  this  operating  scheme  it  is  advantageous  at  this  point  to 
consider  a  representative  scenario  for  the  EMMADS  operation  in 
order  to  highlight  other  features  of  the  routine  checklists.  When 
the  system  powers  up  it  will  begin  to  sample  parameter  data  and 
display  any  detected  faults.  If  the  EMMADS  is  powered  up  before 
engine  start,  many  subsystems  will  have  erroneous  "fault" 
conditions  associated  with  them.  A  method  for  disabling  fault 
displays  must  be  provided,  so  that  as  each  subsystem  powers  up  to 
normal  operation,  the  associated  fault  conditions  can  be  enabled 
for  display.  A  convenient  method  for  doing  this  is  through  the 
routine  checklists  such  as  STARTING  ENGINES  and  ENGINE  GROUND 
OPERATION.  (Note:  It  is  assumed  that  the  APU  must  be  running  or 
that  external  power  is  connected  before  EMMADS  is  powered  up.  In 
the  former  case,  provision  would  have  to  be  made  for  bypassing 
the  first  part  of  the  STARTING  ENGINES  checklist  which  deals  with 
APU  starting.)  The  sample  scenario  is  shown  below: 

a)  The  system  powers  up  and  enables  all  Advisory  condi¬ 
tions  for  display.  In  addition,  faults  11-22,  40-43, 

47,  48,  57  and  58  are  all  enabled  (see  Appendix  3).  The 
display  at  this  point  only  contains  data  in  the 
Dedicated  Status  Area  unless  any  of  the  enabled  faults 
are  detected,  in  which  case  the  display  reflects  the 
highest  priority  faults,  as  described  in  Section 
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3. 2. 1.3.  During  power  up  and  initialization,  the 
switch  legends  should  be  those  shown  in  Figure  8a.  If 
no  faults  are  detected,  the  legends  will  remain  in  that 
state.  If  any  faults  are  detected  the  relegendable 
switches  will  have  their  legends  changed  as  described 
in  Section  3.2. 1.4.2. 

b)  Once  all  faults  are  acknowledged  the  pilot  may  either 
select  the  Dedicated  Status  Area,  specific  subsystem 
data  or  initiate  the  STARTING  ENGINES  checklist  by 
depressing  the  appropriate  MLDS  under  the  display. 

c)  If  the  checklist  option  is  elected,  this  essentially 
places  the  system  in  State  1  of  the  secondary  functions 
mode,  as  shown  in  Figure  10.  Although  the  final  check¬ 
list  formats  are  TBS  (based  on  the  final  results  of 
human  factors  testing),  a  sample  format  is  illustrated 
in  Figure  11.  This  shows  the  essential  elements  of  an 
EMMADS  managed  checklist,  which  are: 

(1)  An  indication  by  the  system  of  what  the  current 
checklist  item  is, 

(2)  A  description  of  the  action(s)  to  be  taken  by  the 
crew  for  each  item  plus  the  required  response,  and 

(3)  An  acknowledgement  by  the  system  that  an  item  is 
complete. 

In  this  example  the  system  identifies  the  current  item 
by  boxing  the  procedure  description  and  the  response. 
The  pilot  accomplishes  the  item  and  indicates 
completion  by  using  the  ACK  switch.  (Note  that  Figure 
11  is  the  only  exception  to  the  rule  that  the  Dedicated 
Status  Area  is  always  displayed.  Once  an  engine  is 
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Figure  11.  Sample  Display  Format  -  Full  Page  Checklist 
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started  the  display  area  available  for  the  checklist 
would  no  longer  include  the  Dedicated  Status  Area.)  of 
When  the  item  is  sensed  as  completed,  the  response 
message  is  changed  to  a  "  "  or  other  suitable 

indication  of  completion  and  the  next  item  is  boxed. 

The  response  section  contains  a  command  word  or  a 
switch  legend  which  changes  during  some  sequenced 

a 

operation,  thereby  modifying  the  action  to  be  taken 
during  the  course  of  accomplishing  that  item.  The  pilot 
follows  these  instructed  changes  as  they  appear.  The 
sequence  of  item  completion  may  loop  back  to  a 
previously  accomplished  item,  changing  the  desired 
response  for  that  item  and  boxing  the  procedure 
description  and  new  response  until  completion  is  sensed 
by  the  system. 

The  checklists  are  indexed  by  having  the  current 
checklist  item  (boxed  procedure  description)  move  down 
from  the  top  until  it  is  in  the  middle  of  the  screen. 

From  this  point  on  the  checklist  items  are  scrolled 
from  bottom  to  top  so  that  the  current  item  always 
maintains  the  same  relative  screen  position.  When  the 
last  item  in  a  checklist  is  completed,  the  next 
actuation  of  the  ACK  switch  clears  the  display  but  the 
system  remains  in  the  state  associated  with  that 
checklist  (see  Figure  10  and  Table  4). 

i 

d)  If  at  any  time  an  enabled  fault  is  detected,  that  fault 
must  be  displayed  in  accordance  with  the  procedures  pre¬ 
viously  outlined.  If  a  fault  occurs  while  running  a 
routine  checklist,  the  checklist  is  replaced  on  the 
display  until  the  fault  is  cleared  and/or  acknowledged. 

If  there  is  an  emergency  procedures  checklist  that 
automatically  follows  on  the  acknowledgement  of  a 
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Warning  then  this  checklist  must  be  completed,  as 
described  in  Section  3.2. 1.5. 


e)  If  no  checklist  is  being  run  and  no  faults  are  pending, 
actuation  of  the  ACK  switch  or  an  appropriate  MLDS 
causes  a  sequencing  within  the  secondary  functions  mode 
to  the  next  appropriate  state  (see  Figure  10)  and 
displays  the  routine  checklist  associated  with  that 
state. 

f)  After  the  last  approach  is  made  and  the  aircraft  is  on 
the  ground,  the  crew  must  manually  select  the  AFTER 
LANDING  CHECKLIST  using  the  appropriate  relegendable 
switch.  Progression  to  the  ENGINE  SHUTDOWN  CHECKLIST 
may  then  be  accomplished  using  the  ACK  switch.  As  each 
system  is  shut  down  the  faults  normally  associated  with 
that  shutdown  are  detected  and  displayed,  thus  allowing 
a  post  flight  check  of  their  operation.  Acknowledgement 
of  these  faults  clears  them  from  the  display  and 
returns  the  display  to  the  checklist  at  the  appropriate 
point . 

An  example  of  the  form  that  routine  CH-47C  checklists  might  take 
when  rewritten  for  incorporation  in  an  EMMADS  is  shown  in 
Appendix  4.  The  section  under  the  heading  "EMMADS  Actions" 
describes  what  the  EMMADS  does  during  each  item  and  is  not  part 
of  the  displayed  information.  These  checklists  do  not  include  any 
Maintenance  Test  Flight  (MTF )  checklists  or  the  Emergency  Start 
(EMER  STRT )  checklist  listed  in  Table  2.  These  switch  legends 
were  provided  to  indicate  such  checklists  as  growth  items  for 
further  development,  since  it  is  recognized  that  EMMADS  must  be 
compatible  with  maintenance  test  flight  activities  and  also 
should  enhance  the  pilot's  ability  to  rapidly  start  the  aircraft 
and  evacuate  it  from  a  hazardous  area  (presumably  under  combat 
conditions).  The  checklists  in  Appendix  4  refer  to  the  list  of 
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faults  in  Appendix  3  by  number,  as  regards  the  enabling  of 
various  fault  conditions.  For  operations  such  as  engine  start 
where  the  pilot  must  normally  cross  correlate  certain  parameters 
(including  time)  with  certain  operations,  EMMADS  performs  these 
functions  for  the  pilot.  For  example,  EMMADS  correlates 
acceleration  with  time  during  engine  start  and  triggers  a  fault 

indication  for  if  ground  idle  speed  is  not  attained  45  seconds 
into  the  start. 

3. 2. 2. 2  Performance  Calculations 
(TBS) 

3. 2. 2. 3  Maintenance  Data  Summary 
(TBS) 
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Reference  the  Operator's  Manual,  P  5-9,  paragraphs  5-23  and  5-24,  the  actual  upper  limit  of  the  normal  N]  speed  range  is  obtained  from  the  engine  test 
log  or  the  engine  overhaul  data  plate.  A  cautionary  limit  is  implied  as  being  set  from  this  maximum  power  speed  up  to  2%  above  this  speed.  However,  the 
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16.  These  circuit  breakers  are  on  a  box  located  at  station  534,  on  the  overhead  structure. 
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Sensors  Include  a  magnetic  pickup  (Hg)t  pressure  switch  ($2)  and  alumel -chrome  1  thermocouple  in  the  APU.  These  sensors  output  signals  to  the 
electronic  sequence  unit  (ESU)  which  supplies  a  timer  and  combinational  logic  to  control  the  APU  hydraulic  start  valve,  fuel  shutoff  valve,  main  fuel 
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Maximum  -  15  seconds 
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Sensor  is  a  pressure  switch  which  provides  a  grounding  path  to  connector  P64M  on  the  caution  panel.  The  threshold  of  3 00  psi  is  for  switch  closure  on 
decreasing  pressure.  The  increasing  pressure,  (switch  open)  threshold  is  400  psi. 
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13.  The  Indicator  markings  used  are  based  on  those  in  the  student  manual  and  procurement  specifications.  The  indicator  range  shown  in  the  Operator's 
Manual  is  0-120  psi  and  the  markings  are  more  in  line  with  operating  limits  (for  the  same  engine)  which  are  detailed  for  the  UH -60A.  Since  the 
procurement  specification  was  obtained  directly  from  Hughes  Helicopters  it  is  presumed  that  that  document  contains  the  most  current  information  on  the 
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FAULT/ PARAMETER  MATRIX  (Cont’d)  (Sheet  5  of  6) 
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FAULT/PARAMETER  MATRIX  (Coin'd)  (Sheet 
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Note  that  fault  29,  Rotor  RPM  Limit/Rate,  has  operating  modes  which  depend  not  only  on  Engine  Condition  Lever  positions,  but 
also  on  the  phase  of  flight.  Thus,  when  the  aircraft  is  on  the  ground,  minimum  continuous  rpm  is  214.  It  in  flight  and  either 
both  engines  are  flamed  out  or  both  condition  levers  are  at  GROUND  or  STOP  the  autorotation  limits  apply. 


Eng  1  Nj  Limit  45  02  Flight  Control  Hydraulic  Press  Limit/Rate 

Eng  2  Ni  Limit  46  Utility  Hydraulic  Press  Limit/Rate 

Eng  1  PTIT  Limit/Rate  47  Utility  Hydraulic  Temp  Limit 
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01  Flight  Control  Hydraulic  Press  Limit/Rate  82  Cargo  Hook  Status 

83  APU  Status 
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reference  signal  slopes  are  not  zero  when  countdown  is  complete,  blank 
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